Privacy Policy

Version 1.0 · effective 02/10/2026

This policy explains what personal information WithOpp BIs ("WithOpp", "we") collects, why, how we use and protect it, who can see it, how long we keep it, and your rights under Tanzania's Personal Data Protection Act, 2022.

WithOpp is operated by Avitus Kashangaki Alex, an individual operating WithOpp while its company registration is completed, Kinondoni, Dar es Salaam, P.O. Box 32017, Tanzania.

1. Who is who

Several people are involved, each in a different role. For example:

WithOpp - the software provider.
ABC Pharmacy - a business that uses WithOpp (our customer).
Sarah - an ABC employee working the till.
John - a customer who buys from ABC.

For the account information of people who use WithOpp (such as ABC and Sarah), WithOpp is the "data controller": we decide how it is used, as described here.

For information a business enters about other people (such as John, its suppliers, or its staff), that business is the "data controller" and WithOpp is the "data processor": we store and process it only on the business's behalf and instructions. We do not use it for our own purposes, and we do not contact a business's customers.

If you are a customer of a shop that uses WithOpp, please contact that shop first about your information. We will help the shop answer you.

2. Information we collect

Category	What exactly	Where it comes from
Your account	Name, email, phone number (if you add it), preferred language, and your password (stored hashed - we cannot see it).	You, at sign-up or when you edit your profile.
Business profile	Business name, type and description, TIN, VRN, registration number, address, city, region, phone, email, branches, currency and tax settings.	The business's owner or an admin.
Team members	Email, display name, role, branch, and whether they are active or suspended.	The owner or an admin, when adding someone.
Each team member's activity	Every sale, payment, return, expense and other change is recorded with the team member who made it and when.	Recorded automatically as WithOpp is used.
Subscription	Plan, subscription status, and trial and billing period dates.	Created automatically when a business is set up.
Business records	Products, prices, costs, stock, batches and expiry dates, sales and receipts, returns, purchase orders, deliveries received, transfers, stock counts, expenses (including the payee's name) and payments (including mobile money or bank reference numbers).	The business's team.
The business's customers	Name, phone, address, credit limit, notes, balance, purchases and payments.	The business's team.
The business's suppliers	Name, contact person, phone, address, notes, balance, purchases and payments.	The business's team.
Security and activity	Sign-in and sign-out times, browser/device type, when you were last active, an audit log including a copy of what was changed, till device names and when they last synced, and your acceptance of these documents (version, time, device).	Recorded automatically.
Technical logs	IP addresses and request logs.	Our hosting and sign-in providers, automatically.
Messages you send us	The content of emails or messages you send us for support or requests.	You.

Your account
What exactly: Name, email, phone number (if you add it), preferred language, and your password (stored hashed - we cannot see it).
Where it comes from: You, at sign-up or when you edit your profile.
Business profile
What exactly: Business name, type and description, TIN, VRN, registration number, address, city, region, phone, email, branches, currency and tax settings.
Where it comes from: The business's owner or an admin.
Team members
What exactly: Email, display name, role, branch, and whether they are active or suspended.
Where it comes from: The owner or an admin, when adding someone.
Each team member's activity
What exactly: Every sale, payment, return, expense and other change is recorded with the team member who made it and when.
Where it comes from: Recorded automatically as WithOpp is used.
Subscription
What exactly: Plan, subscription status, and trial and billing period dates.
Where it comes from: Created automatically when a business is set up.
Business records
What exactly: Products, prices, costs, stock, batches and expiry dates, sales and receipts, returns, purchase orders, deliveries received, transfers, stock counts, expenses (including the payee's name) and payments (including mobile money or bank reference numbers).
Where it comes from: The business's team.
The business's customers
What exactly: Name, phone, address, credit limit, notes, balance, purchases and payments.
Where it comes from: The business's team.
The business's suppliers
What exactly: Name, contact person, phone, address, notes, balance, purchases and payments.
Where it comes from: The business's team.
Security and activity
What exactly: Sign-in and sign-out times, browser/device type, when you were last active, an audit log including a copy of what was changed, till device names and when they last synced, and your acceptance of these documents (version, time, device).
Where it comes from: Recorded automatically.
Technical logs
What exactly: IP addresses and request logs.
Where it comes from: Our hosting and sign-in providers, automatically.
Messages you send us
What exactly: The content of emails or messages you send us for support or requests.
Where it comes from: You.

We do not collect payment card numbers, health information, fingerprints, photos, or your location (GPS). We use no advertising or tracking cookies.

3. Why we use it

Purpose	Information used	Legal basis
Creating and running your account	Your account	Contract
Providing the service: selling, stock, purchasing, debts, reports and insights	Business profile, business records, customers, suppliers	Contract; for customer and supplier details - on the business's instructions
Controlling who can do what, and recording each team member's activity	Team members, each team member's activity	Contract; the business's legitimate interest in preventing theft and errors
Managing WithOpp subscriptions and payments	Subscription, business profile	Contract
Security and fraud prevention	Security and activity, technical logs	Legitimate interests; legal obligation
Support and essential service messages (email confirmation, password reset)	Your account, messages you send us	Contract
Improving WithOpp using aggregated statistics that identify no person or business	Aggregated usage statistics	Legitimate interests
Complying with the law and lawful requests from authorities	Only what the law requires	Legal obligation

Creating and running your account
Information used: Your account
Legal basis: Contract
Providing the service: selling, stock, purchasing, debts, reports and insights
Information used: Business profile, business records, customers, suppliers
Legal basis: Contract; for customer and supplier details - on the business's instructions
Controlling who can do what, and recording each team member's activity
Information used: Team members, each team member's activity
Legal basis: Contract; the business's legitimate interest in preventing theft and errors
Managing WithOpp subscriptions and payments
Information used: Subscription, business profile
Legal basis: Contract
Security and fraud prevention
Information used: Security and activity, technical logs
Legal basis: Legitimate interests; legal obligation
Support and essential service messages (email confirmation, password reset)
Information used: Your account, messages you send us
Legal basis: Contract
Improving WithOpp using aggregated statistics that identify no person or business
Information used: Aggregated usage statistics
Legal basis: Legitimate interests
Complying with the law and lawful requests from authorities
Information used: Only what the law requires
Legal basis: Legal obligation

We do not sell your information. We do not show advertising. We never share one business's records with another business. WithOpp does not currently send any information to artificial intelligence (AI) services; insights inside WithOpp come from fixed rules within our own system and are advice only - no automated decision is made about you that affects your rights.

If we ever need your consent for something, we will ask clearly, and you can withdraw it at any time.

5. Where it is stored

WithOpp data is stored outside Tanzania, in the European Union (see section 4). The European Union has strong data protection law (the GDPR).

The Personal Data Protection Act, 2022 allows personal data to be transferred abroad where it stays adequately protected and with a permit from the Personal Data Protection Commission (PDPC). We make these transfers in line with that law, using contracts with our providers, encryption while data is in transit, and strict controls on who can access it.

6. How we protect it

All traffic between your device and WithOpp is encrypted (HTTPS).
Role permissions are checked inside the database for every action; one business can never see another business's data.
An audit log shows who added, changed or deleted what.
No system is 100% secure. Please use a strong password, never share it, and keep till devices secure.

7. Information on your device

So the till keeps working without internet, WithOpp stores on your device: the product and price list, sales made offline until they are sent, and recent receipts. We also use an essential cookie to keep you signed in, and we store your language and appearance choices.

If you clear your browser data before offline sales have been sent, those sales can be lost. The full list is in the Cookie Policy.

8. How long we keep it

While your account and business are active, we keep the information needed for the service to work.
If you close a business or account, you have 60 days to get a copy of your records. After that we delete them, except where the law requires us to keep some for longer.
Tanzanian tax law requires businesses to keep their records for at least 5 years. That duty is your business's - please get a copy of your records before closing.
If you ask for a business or your account to be deleted, we first confirm it is really you. The data is then hidden and locked (nobody can use it) for 30 days, so that a request made by mistake can be undone. After that it is permanently deleted - business records are removed, and a person's account is anonymised (name, email, phone and sign-in methods are removed).
Security and sign-in logs are kept as long as needed for security and resolving disputes, then deleted. Backup copies kept by our providers are removed on their normal schedule.

9. Your rights

Under the Personal Data Protection Act, 2022 you have the right to:

Know whether we process your information and get a copy of it.
Have inaccurate information corrected (most of it you can correct yourself in WithOpp).
Ask for your information to be deleted, or its use restricted, when it is no longer needed or has been processed unlawfully.
Object to your information being used for direct marketing, or for legitimate interests where your particular situation justifies it.
Get a copy of your records in a usable format (the business owner can download them directly in Settings → Your data).
Withdraw your consent where we relied on it.
Not be subject to decisions made solely by machines that affect your rights.
Complain to the Personal Data Protection Commission (PDPC) - www.pdpc.go.tz.

Send your request as described in section 14. We will verify your identity and reply within 30 days. If your information was entered by a shop you bought from, we will pass your request to that shop.

10. Responsibilities of businesses using WithOpp

Because the business is the controller of its customers', suppliers' and staff's information, it agrees to:

Collect their information lawfully and tell them how it is used - including telling staff that their activity in WithOpp is recorded.
Record only what is needed (e.g. name and phone for a credit customer), and not put sensitive information such as health details in notes.
Register with the Personal Data Protection Commission (PDPC) where the law requires it, and answer people's requests about their information - we will help.

11. Children

WithOpp is not for anyone under 18. We do not knowingly collect children's information.

12. Security breaches

If we discover that information was leaked or accessed without permission, we will notify the Personal Data Protection Commission (PDPC) without undue delay - aiming for within 72 hours - and the affected businesses, explaining what happened and what we have done.

13. Changes to this policy

If we change this policy in a way that affects your rights, we will tell you inside WithOpp and ask you to acknowledge it again before continuing. Every earlier version stays readable in the Legal & Trust Center.

14. Requests and contact

Email withopp.bis@gmail.com for any of the following. A subject line naming the type of request helps us answer faster:

Privacy question
Request for a copy of your information
Request to correct information
Request to delete information
Security report
Billing dispute
Legal notice or legal question

Include your name, your account email and the business name (if any). Phone: +255 749 253 965. Address: Avitus Kashangaki Alex, Kinondoni, Dar es Salaam, P.O. Box 32017, Tanzania.